# 1. Full TCP Port Scan on Target Host

## 1. Full TCP Port Scan on Target Host

To begin any pentest, you must discover what services the machine is running. A full TCP port scan helps uncover all active ports, even if services are running on unusual ports.

**Tool Used**: nmap

Chosen for its speed, versatility, and accuracy in network scanning.

```bash
nmap -Pn -sS -p- 192.168.10.4
```

* `-Pn`: Skip ping (Treat host as online)
* `-sS`: SYN scan for stealth and speed (if you are not root, run it with sudo)
* `-p-`: Scan all 65535 TCP ports

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FMZRNkcPscCb4RJ1ijDi1%2F1-nmap.jpg?alt=media&#x26;token=2bde8e2d-1c25-45b5-ac0f-e13ddeb591d9" alt=""><figcaption></figcaption></figure>

**Hints & Tips**:

1. Always scan all ports (`-p-`) to avoid missing hidden services.
2. Use `-Pn` if ICMP is blocked or when you treat host as online.

&#x20;

***

***





